3 ms·
In a theoretical scenario like this where a hijacker used Let's Encrypt to receive a cert, rather than using a self-signed one, it's worth mentioning that there
by massaman_yams 8y ago
In a theoretical scenario like this where a hijacker used Let's Encrypt to receive a cert, rather than using a self-signed one, it's worth mentioning that there is a defense against that: HPKP - though much like HSTS, this is only effective for browsers that have previously visited the site.
https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning